Custom PAN-OS Metrics Published for Monitoring

Chris-Chapman — Fri, 17 Mar 2023 13:29:56 GMT

Hi Folks,

I'm looking to setup some alerts in Azure based of the PAN-OS custom metrics which are published to Application Insights.

First - Does anyone know if the values published represent a point in time when the metrics are posted or an average since the last post?

Second - It looks to me like the only identifier for the firewall that generated the log entry is customDimensions.InstanceId. This instance Id seems to be a unique ID set in deep in the VMs BIOS, does anybody know how to tie that back to a specific VMid or Name?

Cheers

Re: Custom PAN-OS Metrics Published for Monitoring

Chris-Chapman — Tue, 27 Jun 2023 10:39:24 GMT

If this helps anyone else:

Does anyone know if the values published represent a point in time when the metrics are posted or an average since the last post?

TAC have confirmed its a point in time measurement when the metrics are posted to app insight.

It looks to me like the only identifier for the firewall that generated the log entry is customDimensions.InstanceId. This instance Id seems to be a unique ID set in deep in the VMs BIOS, does anybody know how to tie that back to a specific VMid or Name?

TAC were pretty useless in answering this...Their SME said to contact Azure for an answer and that it was not a value populated by the plugin. - which is just not true.

From what I can tell the value comes from

show system state | match cfg.platform.instance-id

and would appear to represent (https://azure.microsoft.com/en-us/blog/accessing-and-using-azure-vm-unique-id/) - but that is just a guess as I can't interrogate the BIOS to confirm.

So it's a pretty poor identifier to include in the metrics.

topic Custom PAN-OS Metrics Published for Monitoring in VM-Series in the Public Cloud

Custom PAN-OS Metrics Published for Monitoring

Re: Custom PAN-OS Metrics Published for Monitoring